GitLab CVE-2026-97229 Post-Exploitation Runner Registration and Egress Tooling

Suraj A@cytech

•updated yesterday•2•0•5

Detects Linux process activity consistent with post-exploitation of a self-managed GitLab instance (CVE-2026-97229). This includes editing of gitlab.rb configuration files, registration of CI runners or creation of tokens via gitlab-rails/gitlab-rake, and outbound curl/wget connections launched by GitLab service accounts.